Validate file hashes using the configured hash algorithm

[Arpit Jain (arpitjain099)]

Summary

ConcurrentSha256HashValidator always pulls the SHA256 checksum out of InternalSbomFileInfo, but FileHasher hashes files with whatever -HashAlgorithm the caller passed. Validate an SBOM whose files only carry SHA1 checksums with -HashAlgorithm sha1 and both sides come back null, string.Equals(null, null, ...) returns true, and every file is reported as validated without a single byte being compared.

I hit this with a tampered file and a SHA1-only manifest. Before the change validate ... -HashAlgorithm sha1 printed Result: Success with FilesSuccessfulCount: 1; after it, the same run reports Failure with FilesFailedCount: 1, and an untampered copy of the same tree still passes.

Changes

• Take IConfiguration in the validator and look up configuration.HashAlgorithm, falling back to SHA256 when it is not set. HashValidator already takes the configuration this way.
• Treat a missing hash on either side as a failure instead of a match, since there is nothing to compare.
• Pass the configuration through from SbomValidationWorkflowFactory.
• Tests for the matching and missing-checksum cases, plus the three existing construction sites.

The class name still says Sha256 and is now misleading. I left it alone to keep the diff reviewable, happy to rename it in this PR if you would rather.

dotnet test test/Microsoft.Sbom.Api.Tests is green, 369 passed.